PT-2025-48944 · Masacms · Masacms

Published 2025-12-03 · Updated 2025-12-08 · CVE-2024-32641

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Masa CMS versions prior to 7.2.8 Masa CMS versions prior to 7.3.13 Masa CMS versions prior to 7.4.6

Description Masa CMS is an open source Enterprise Content Management platform. The application is susceptible to remote code execution. The issue resides in the addParam function, which processes user-supplied input through the criteria parameter. This input is then evaluated by the setDynamicContent function, enabling an unauthenticated attacker to execute arbitrary code using the 'm' tag.

Recommendations Update Masa CMS to version 7.2.8 or later. Update Masa CMS to version 7.3.13 or later. Update Masa CMS to version 7.4.6 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-32641

GHSA-CJ9G-V5MQ-QRJM

Affected Products

Masacms

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32641.json · Exploit
• https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-cj9g-v5mq-qrjm · Vendor Advisory
• https://github.com/MasaCMS/MasaCMS/commit/fb27f822fe426496af71205fa35208e58823fcf6 · Patch
• https://osv.dev/vulnerability/CVE-2024-32641 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32641 · Security Note
• https://twitter.com/SecAideInfo/status/1997248318909329567 · Twitter Post
• https://twitter.com/CveFindCom/status/1996273102825607500 · Twitter Post
• https://twitter.com/cracbot/status/1997984566532050988 · Twitter Post
• https://twitter.com/ET_Labs/status/1996348564457582854 · Twitter Post
• https://twitter.com/CVEnew/status/1996261685854974259 · Twitter Post
• https://twitter.com/0dayPublishing/status/1996258179861115206 · Twitter Post